Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89952— mtd: rawnand: validate ONFI extended parameter page sections

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： mtd: rawnand: 校验 ONFI 扩展参数页的各部分（sections） 函数 会根据 ONFI 参数页所声明的长度分配内存空间，随后将数据视为“固定头部 + 可变长度各部分”的结构进行处理。然而，该函数在读取头部并遍历各部分时，并未先验证固定页大小及每个当前部分是否能在已分配的内存范围内完整容纳。 修复措施： 拒绝长度短于固定头部的参数页； 在遍历各部分时，持续跟踪剩余可变区域的范围； 要求 ECC 部分必须包含从 中读取的所有字段； 使用以设备为范围的诊断

AI Predicted 5.9 Difficulty: Hard EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< 1bf148fabe6463422195b7cc43b3412533f1dc21 affected
6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< c7df90bbda71549bfd981bf478ad04ddfccf4e0d affected
6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< 86948f81964e40cd6472d76a6371e4f297d84db0 affected
6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< ddb6ddf5be7429bb98b3368c883be51f00b31678 affected
6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< 12a63a0f0d17b2d26211b2524ded91a67dd5c99c affected
6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< c8f86e375b39cada09fd8cb33dd3bb3641e84a62 affected
6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< 23e747fe585830c43095c37c85b2757231c6917f affected
6dcbe0cdd83fb5f77be4f44c9e06c535281c375a< e5e415262330bd70f983e091d8919d9dcd99e475 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89952

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mtd: rawnand: validate ONFI extended parameter page sections
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nand_flash_detect_ext_param_page() allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It reads that header and advances over sections without first proving that the fixed page and each current section fit in the allocation. Reject pages shorter than the fixed header, track the remaining variable area while walking sections, and require the ECC section to contain every field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics that identify the malformed ONFI section.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a ~ 1bf148fabe6463422195b7cc43b3412533f1dc21 -
Linux Linux 3.12 -

II. Public POCs for CVE-2026-89952

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89952

请登录查看更多情报信息。

Other References for CVE-2026-89952 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89952

No comments yet

Leave a comment